Extracted

• • Target

    234d425a3c85a27252fa477d05a387a30a6e248f1ea17b2e7fcaac13cb9c8db3.exe

  • Size

    680KB

  • MD5

    c2855f1c6721f12db295ec53b0b7de27

  • SHA1

    1fd7d75d3f8a54f329ddba0ead08cc1479078dd2

  • SHA256

    234d425a3c85a27252fa477d05a387a30a6e248f1ea17b2e7fcaac13cb9c8db3

  • SHA512

    1812c8be95404ed1d4e5c26a75a0ef90d8d9f8366231c644ca7542331cb4fd0a7319ae01d669e30f64808028b84ed690c3f6abf9abc0eea0b797411927385558

  • SSDEEP

    12288:vpdYkj8CFtxtIT2BenxiJC7vokQwpP2zk/fb3I3UTvJrDE6x:j9j8anIHGuT4kcEvq+

  Score

  10^/10

  formbookae30discoveryexecutionratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook family

    formbook

  • Formbook payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2